nx_connect_e2e_client.nx

nx_connect_e2e_client.nx -- the FULL-E2E CONNECT client: key AGREEMENT + sealed send + decrypting inbox, all client-side, all sovereign crypto compiled to WASM. This is the page that escapes the zero-JS security ceiling AND closes the two rungs the 2026-07-23 honest grade left open: (a) the conversation key is no longer typed -- it is AGREED via X25519 (RFC 7748; the shipped wasm is KAT-proven in nx_wasm_vm: nx_x25519_wasm_vm_gate + nx_connect_keyx_vm_gate 5/5 DH agreement); (b) the recipient has a DECRYPT view -- the inbox fetches ciphertext routed by the server's shared content-blind plane and decrypts it in the browser with the same agreed key. The cipher is sovereign ChaCha20 (nx_media_crypt_wasm; RFC 8439 bit-exact in-VM, gate 3/3). The JS is the ACCEPTED minimum last-mile: instantiate wasm + marshal bytes + DOM. ALL crypto is in the wasm. HONEST SCOPE (stated on the page too): the name->pubkey directory is first-come/latest-wins with NO identity binding yet (classic TOFU gap; OPAQUE-bound identities = the next rung), and private keys live in this browser's localStorage (per-name, so one browser can demo both ends). nx_connect_e2e_client <chacha.wasm> <x25519.wasm> <out.html> ce_emit_html(b64c, b64clen, b64x, b64xlen, dst) is the pure emitter (gate-testable without real wasm). license_tier: ORIGINAL